# Listen only on LAN + WireGuard + loopback
bind-interfaces
listen-address=127.0.0.1,192.168.33.5,10.50.0.1,172.22.0.1

# Upstream = Unbound (recursive) on loopback
no-resolv
server=127.0.0.1#5353@127.0.0.1

# Hygiene
domain-needed
bogus-priv
cache-size=10000

# Optional: log queries while testing (disable later if you prefer)
# log-queries
# log-facility=/var/log/dnsmasq.log